MALICIOUS — 2994dd_86c305efd77e469e9b1a3fa8eb26320a.pdf
MALICIOUS — 2994dd_86c305efd77e469e9b1a3fa8eb26320a.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.
Identification
- SHA-256:
f52b57da57d6b7137c2f751c58e430033b980c95142423937b930d9effe40afd - SHA-1:
285b8f772a3858af161e543e32eceb88fb6136f1 - MD5:
84e34d72772050f1d8137bbd583f0ef6 - ssdeep:
768:6gGzpDMfrwnJEvc4Iuz9uJAqF2LPQF2uNrx7PVnsO7fgZHpnS+cpbqX:nGFAbLz+AZLPQF3xJVnz74HpnVcpbqX - TLSH:
T18932AFF39097EC882BCB9F536EDA15595146C28D7027D2B065D87B2CC87C2FD6E40A22 - Submitted as: 2994dd_86c305efd77e469e9b1a3fa8eb26320a.pdf
- File type: pdf · Size: 43551 bytes
- Verdict: malicious (78/100)
Detections (2 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The malicious score of 78/100 is the fusion of 5 weighted signals:
- Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule
PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://ttraff.club/wix?keyword=anatomy+of+movement+pdf, https://cdn.shopify.com/s/files/1/0433/1791/9912/files/52492501990.pdf, https://cdn.shopify.com/s/files/1/0459/1285/0581/files/chhota_bheem_video_cartoon_hd.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://ttraff.club/wix?keyword=anatomy+of+movement+pdf
- https://cdn.shopify.com/s/files/1/0430/1930/5113/files/convert_slope_intercept_to_standard.pdf
- https://cdn.shopify.com/s/files/1/0433/1791/9912/files/52492501990.pdf
- https://cdn.shopify.com/s/files/1/0459/1285/0581/files/chhota_bheem_video_cartoon_hd.pdf
- https://cdn.shopify.com/s/files/1/0429/7487/1711/files/filubizufovizuwiwujata.pdf
- https://25f6dffb-7213-4c0c-a1fb-344d591bc2d3.filesusr.com/ugd/bfbc46_33e6281e650446ae93187974c175488c.pdf?index=true
- https://d661aab1-88f2-402c-a6a5-4295e19fc2a9.filesusr.com/ugd/48bf55_fb96224d17e84ff1a84afb3c7a4e0b55.pdf?index=true
- https://2fe390de-72b7-4b0f-a23e-c7b661802f2d.filesusr.com/ugd/3225da_d330100ee45c40bca38a6aa3770baa31.pdf?index=true
- https://483b2783-0303-4fc0-8b89-3a70a5ff41e9.filesusr.com/ugd/f1780b_fe01a5ebee344fb584cc87ca3b6ab59a.pdf?index=true
- https://4f90742c-13ee-47d8-9168-c4d3151e4412.filesusr.com/ugd/3be48b_f34e034b34b943008a8bb7cb90dc1cec.pdf?index=true
- https://1b71e83d-758c-48da-8396-d7179eb19faa.filesusr.com/ugd/227d0f_f21861fd7cd84aa7b9b29a8b14cd40ef.pdf?index=true
- https://235fd3b6-c81a-4169-be92-020b64e254af.filesusr.com/ugd/2994dd_93a104e0b6da43428e445225d401fef3.pdf?index=true
- https://a1687060-5be2-46bd-9100-8d6b4778bebf.filesusr.com/ugd/8c2e83_e7682023e5bd49a3abf36595c763d05f.pdf?index=true
- https://db58a6a0-6ff4-499d-80ec-dea5386fbbff.filesusr.com/ugd/3225da_9ae6e92044654c36ab2395bd1f33855c.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Embedded domains
- ttraff.club
- cdn.shopify.com
- 25f6dffb-7213-4c0c-a1fb-344d591bc2d3.filesusr.com
- d661aab1-88f2-402c-a6a5-4295e19fc2a9.filesusr.com
- 2fe390de-72b7-4b0f-a23e-c7b661802f2d.filesusr.com
- 483b2783-0303-4fc0-8b89-3a70a5ff41e9.filesusr.com
- 4f90742c-13ee-47d8-9168-c4d3151e4412.filesusr.com
- 1b71e83d-758c-48da-8396-d7179eb19faa.filesusr.com
- 235fd3b6-c81a-4169-be92-020b64e254af.filesusr.com
- a1687060-5be2-46bd-9100-8d6b4778bebf.filesusr.com
- db58a6a0-6ff4-499d-80ec-dea5386fbbff.filesusr.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report